Argo Workflows (controller, expression template evaluation of input parameters): When EXPRESSION_TEMPLATES is on and

Impact

When EXPRESSION_TEMPLATES is on and untrusted users can set workflow input parameters, the supplied value gets evaluated as an expression template. A tenant can disrupt or distort another workflow's execution by feeding in crafted parameters rather than plain data.

Who can reach it

Any user permitted to specify input parameters on a workflow run, on a controller with expression templates enabled.

What to do

Upgrade the controller to 3.1.6 or later and restart. If you cannot upgrade immediately, disable EXPRESSION_TEMPLATES or stop accepting workflow input parameters from untrusted principals.

References